Sonarqube not showing security hotspots

user_2729605 0
Viewed 1708

I'm testing SonarQube Community Edition, Version 7.9.4 (build 35981) (because LTS) with some js code intentionally dangerous, such as:

 eval(evt.body);
const net = require('net');

var socket = new net.Socket(); // Questionable
socket.connect(80, 'google.com');

// net.createConnection creates a new net.Socket, initiates connection with socket.connect(), then returns the net.Socket that starts the connection
net.createConnection({ port: port }, () => {}); // Questionable

// net.connect is an alias to net.createConnection
net.connect({ port: port }, () => {}); // Questionable

let password = 'my totally secret password';
console.log(password);

(everything taken from the examples of security issues given in the Quality Profile: Sonar way Recommended)

But I cannot see any errors on the dashboard. Bugs and Code Smells are showing.

From the documentation I read: Why don't I see any Vulnerabilities or Security Hotspots?

You might not see any Vulnerabilities or Security Hotspots for the following reasons:

  • You don't have any because the code has been written without using any security-sensitive API.
  • Vulnerability or Security Hotspot rules are available but not activated in your Quality Profile so no Security Hotspots or
  • Vulnerabilities are raised. The analyzer for your language might only currently offer a few rules and won't raise any or only a small number of Vulnerabilities
    or Security Hotspots.

#1 is not possible because I have put bad code on purpose.

#2 my "Sonar way Recommended" says that it has 13 active security hotspots

#3 I don't know how to set up a specific analyser

I tried also disabling the Quality Gate (putting a phony one) just in case not having any coverage were preventing other errors to be shown, with no avail.

Is there something I can do to have those errors showing up?

EDIT: if the solution is to change the version, I could do it as well

sonarqube javascript
1 Answers

For other readers: The problem was that I was trying to test too many things at once, so not only security hotspots but general linting errors, const redefined twice, let not redefined, and redefinition of variables with the let keyword:

let x=1
// some other lines...
let x='two'

After 'solving' those errors first (they were not intended to be solved but shown on purpose...) now I can see security hotspot issues

user_27296050
Related